Managing the WSUS Automatic Updates Client Download, Install, and Reboot Behavior with Group Policy

http://technet.microsoft.com/en-us/library/cc512630.aspx

A security update that requires the system to be rebooted is not installed ... until such time as the system is rebooted ... and a client can no longer detect the need for future updates until the reboot has occurred.